Bump go-pkgz/auth to reject foreign tokens in email login

backend/app/cmd/server_test.go

@@ -29,6 +29,8 @@ import (
 	cache "github.com/go-pkgz/lcw/v2"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+
+	"github.com/umputun/remark42/backend/app/notify"
 )
 
 const (
@@ -1491,3 +1493,44 @@ func TestServerCommand_servesAudience(t *testing.T) {
 	cmd.Store.Type = "rpc"
 	assert.True(t, cmd.servesAudience([]string{"Remark"}), "a remote store decides which sites exist")
 }
+
+// TestServerApp_UnsubscribeTokenIsNotALogin covers the token in unsubscribe links: it names the user
+// and their email, is signed with the shared secret and is valid for a century, so the email login
+// must not accept it in place of a confirmation token it issued itself.
+func TestServerApp_UnsubscribeTokenIsNotALogin(t *testing.T) {
+	port := chooseUnusedPort(t)
+	app, ctx, cancel := prepServerApp(t, func(o ServerCommand) ServerCommand {
+		o.Port = port
+		o.emailMsgTemplatePath, o.emailVerificationTemplatePath = "", "" // the embedded templates, as in production
+		return o
+	})
+	defer cancel()
+
+	go func() { _ = app.run(ctx) }()
+	waitForHTTPServerStart(t, port)
+
+	destinations, err := app.makeNotifyDestinations(app.authenticator)
+	require.NoError(t, err)
+	var tkn string
+	for _, d := range destinations {
+		if e, ok := d.(*notify.Email); ok {
+			tkn, err = e.TokenGenFn("email_user1", "user1@example.org", "remark")
+			require.NoError(t, err)
+		}
+	}
+	require.NotEmpty(t, tkn, "email notifications are configured, so unsubscribe links carry a token")
+
+	client := http.Client{Timeout: 10 * time.Second}
+	defer client.CloseIdleConnections()
+	resp := getRetryThrottled(t, &client, fmt.Sprintf("http://localhost:%d/auth/email/login?token=%s", port, tkn))
+	body, err := io.ReadAll(resp.Body)
+	require.NoError(t, err)
+	require.NoError(t, resp.Body.Close())
+	assert.Equal(t, http.StatusForbidden, resp.StatusCode, "an unsubscribe token is not a login, %s", body)
+	for _, c := range resp.Cookies() {
+		assert.NotEqual(t, "JWT", c.Name, "no session from an unsubscribe token")
+	}
+
+	cancel()
+	app.Wait()
+}

backend/go.mod

@@ -7,7 +7,7 @@ require (
 	github.com/PuerkitoBio/goquery v1.13.0
 	github.com/alecthomas/chroma/v2 v2.27.0
 	github.com/didip/tollbooth/v8 v8.0.1
-	github.com/go-pkgz/auth/v2 v2.3.0
+	github.com/go-pkgz/auth/v2 v2.3.1
 	github.com/go-pkgz/jrpc v0.4.2
 	github.com/go-pkgz/lcw/v2 v2.1.0
 	github.com/go-pkgz/lgr v0.12.4

backend/go.sum

@@ -40,8 +40,8 @@ github.com/gavv/httpexpect v2.0.0+incompatible h1:1X9kcRshkSKEjNJJxX9Y9mQ5BRfbxU
 github.com/gavv/httpexpect v2.0.0+incompatible/go.mod h1:x+9tiU1YnrOvnB725RkpoLv1M62hOWzwo5OXotisrKc=
 github.com/go-oauth2/oauth2/v4 v4.5.4 h1:YjI0tmGW8oxVhn9QSBIxlr641QugWrJY5UWa6XmLcW0=
 github.com/go-oauth2/oauth2/v4 v4.5.4/go.mod h1:BXiOY+QZtZy2ewbsGk2B5P8TWmtz/Rf7ES5ZttQFxfQ=
-github.com/go-pkgz/auth/v2 v2.3.0 h1:Y/ZZaMfn0YrxNC+3wh+U/n0fH+Jwanfjur+nZ/9XO3Y=
-github.com/go-pkgz/auth/v2 v2.3.0/go.mod h1:iZx2JiGZ8Aef+wM0BPLMQY8aur4fLE0uyPhFRO9dYQ4=
+github.com/go-pkgz/auth/v2 v2.3.1 h1:ReJat7qXaaqSjsTrZGsWyaM5dvXuGF65qG7lfELlh7s=
+github.com/go-pkgz/auth/v2 v2.3.1/go.mod h1:iZx2JiGZ8Aef+wM0BPLMQY8aur4fLE0uyPhFRO9dYQ4=
 github.com/go-pkgz/email v0.8.0 h1:6+Tgjfj7zFccFCPmURV2spKDXDb7aX/iWXBY2hBa9ww=
 github.com/go-pkgz/email v0.8.0/go.mod h1:+wgi4x7S33IuCzfcCM5euN0GwQG6XvO/PBLxrNffYLI=
 github.com/go-pkgz/expirable-cache/v3 v3.1.1 h1:ryHiSI5gBE8aJ0Jt90VFMKZxe/cosf2dZPDcUTMaHNg=

backend/vendor/modules.txt

@@ -44,7 +44,7 @@ github.com/dlclark/regexp2/v2/syntax
 github.com/go-oauth2/oauth2/v4
 github.com/go-oauth2/oauth2/v4/errors
 github.com/go-oauth2/oauth2/v4/server
-# github.com/go-pkgz/auth/v2 v2.3.0
+# github.com/go-pkgz/auth/v2 v2.3.1
 ## explicit; go 1.25.0
 github.com/go-pkgz/auth/v2
 github.com/go-pkgz/auth/v2/avatar